fix: wildcard-target probe, per-run provenance, qwen via Hermes, broad default web objective

- Wildcard target from a scope-file (target: "*.nasa.gov") was probed literally
  → "builder error" / target unreachable. It's now reduced to the apex
  (https://nasa.gov) for the seed, while the scope keeps *.nasa.gov so subdomain
  enumeration stays authorized. (The /target command already did this; the
  engagement-file meta path didn't.)
- Provenance was a OnceLock ("first run wins"), so in the REPL every run after
  the first minted markers and the provenance line with the FIRST run's id
  (nasa run showing a rockstargames id). Now a RwLock that rebinds per run —
  each engagement gets its own id; the build fingerprint stays stable.
- Nous/Hermes: qwen3.8-max / qwen3.8-omni-flash added to the provider list so
  `nous:qwen3.8-max` routes qwen through the Hermes portal (model name passes
  through `hermes chat -m <model> --provider nous`).
- Black-box `run` now gets a broad DEFAULT objective when none is set: a
  comprehensive WEB assessment grounded in OWASP Top 10 / ASVS / WSTG / CWE that
  traverses every applicable web vuln class then goes deep — web-only (this path
  loads only web vuln agents; mobile/binary are separate modes), so it never
  drifts into mobile/exe.

423 tests passing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

neurosploit-rs/app/src/main.rs

@@ -1925,8 +1925,9 @@ fn handle_provenance(cmd: ProvCmd) -> anyhow::Result<()> {
             }
             // A marker carrying this build's fingerprint came from this binary;
             // one that does not still came from NeuroSploit, just elsewhere.
-            let mine = marks.iter().filter(|m| m.contains(&Provenance::process().build[..6])).count();
-            println!("  \x1b[2m{mine} of them minted by this build ({}), the rest by another\x1b[0m", Provenance::process().build);
+            let bld = Provenance::process().build;
+            let mine = marks.iter().filter(|m| m.contains(&bld[..6.min(bld.len())])).count();
+            println!("  \x1b[2m{mine} of them minted by this build ({bld}), the rest by another\x1b[0m");
         }
         ProvCmd::Verify { dir } => {
             let dir = std::path::Path::new(&dir);